Security readout for executives and security teams
Plain-English summary
This issue affects legacy Neo4j deployments through 3.4.18 when the shell server is enabled. That configuration can expose an RMI service that mishandles Java object deserialization, creating a path to remote code execution. Business urgency is highest where old Neo4j systems are reachable from untrusted networks.
Executive priority
Treat as a priority legacy-platform exposure review, especially for database systems reachable beyond trusted admin networks. Remote code execution potential makes this high impact, but urgency depends on whether the vulnerable shell/RMI configuration exists.
Technical view
CVE-2021-34371 describes arbitrary Java object deserialization in Neo4j through 3.4.18 with shell server enabled. The exposed RMI service can deserialize attacker-controlled objects, including via setSessionVariable, and exploitable gadget-chain dependencies can enable remote code execution. The source bundle provides no CVSS, CWE, CPE, or vendor fix details.
Likely exposure
Exposure is limited to Neo4j through 3.4.18 where the shell server is enabled and the RMI service is reachable. Internet-facing or broadly reachable internal database hosts are the main concern. The provided affected-product metadata is incomplete.
Exploitation context
The CVE is not listed as KEV in the source bundle, so active exploitation is not established here. A public Exploit-DB reference exists, indicating public exploit information is available. Do not assume exploitation in your environment without telemetry or confirmed indicators.
Researcher notes
Key gaps: no CVSS, CWE, CPE, vendor advisory, or explicit patch version is present in the bundle. The strongest evidence is the CVE description and Exploit-DB reference. Validate configuration before escalating broadly.
Mitigation direction
- Inventory Neo4j versions and identify deployments at or below 3.4.18.
- Confirm whether the Neo4j shell server is enabled.
- Disable the shell server where it is not operationally required.
- Restrict RMI exposure to trusted administrative networks only.
- Check Neo4j guidance for supported upgrade or remediation options.
Validation and detection
- Review configuration for shell server enablement on Neo4j hosts.
- Verify RMI service reachability from untrusted network segments.
- Confirm running Neo4j version against the through-3.4.18 affected range.
- Check logs for suspicious shell or RMI access patterns.
- Document whether each instance is remediated, isolated, or accepted risk.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Execution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-34371 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.exploit-db.com/exploits/50170CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.